The vulnerability CVE-2025-24690 affects Michele Giorgi Formality, a PHP-based application, through improper control of filenames used in include or require statements. This weakness enables PHP Local File Inclusion, potentially allowing attackers to execute arbitrary code or access sensitive files on the server. The affected versions include all releases up to and including 1.5.7. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files or execute arbitrary code within the context of the web server. This compromises confidentiality, integrity, and availability of the affected system. The high CVSS score indicates a serious security risk. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted inputs that could influence include/require statements.